CVE-2018-15425 — Improper Input Validation in Cisco Identity Services Engine Software

CWE-20 — Improper Input ValidationCWE-502 — Deserialization of Untrusted DataCWE-434 — Unrestricted File Upload4 documents4 sources
Severity
4.7MEDIUMNVD
EPSS
0.3%
top 47.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services Engine SoftwareCisco Identity Services Engine
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LExploitability: 1.2 | Impact: 3.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-f3wr-m2wm-39gh: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute↗2022-05-13
▶
CVEList
Multiple Vulnerabilities in Cisco Identity Services Engine↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Multiple Vulnerabilities in Cisco Identity Services Engine↗2018-10-03
▶
CVE-2018-15425 — Improper Input Validation in Cisco | cvebase